[Snyk] Upgrade sharp from 0.32.0 to 0.34.4

[geekswagg]

Snyk has created this PR to upgrade sharp from 0.32.0 to 0.34.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 42 versions ahead of your current version.

• The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Heap-based Buffer Overflow SNYK-JS-SHARP-5922108	909	Mature
	Improper Link Resolution Before File Access ('Link Following') SNYK-JS-TARFS-10293725	909	No Known Exploit
	Symlink Attack SNYK-JS-TARFS-9535930	909	Mature
	Symlink Following SNYK-JS-TARFS-13045213	909	No Known Exploit

Release notes

Package name: sharp

• 0.34.4 - 2025-09-17
  

  • Upgrade to libvips v8.17.2 for upstream bug fixes.

  • Ensure TIFF subifd and OpenSlide level input options are respected (regression in 0.34.3).

  • Ensure autoOrient occurs before non-90 angle rotation.
    #4425

  • Ensure autoOrient removes existing metadata after shrink-on-load.
    #4431

  • TypeScript: Ensure KernelEnum includes linear.
    #4441
    @ BayanBennett

  • Ensure unlimited flag is passed upstream when reading TIFF images.
    #4446

  • Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
    #4451

  • Add sharp-libvips rpath for yarn v5 support.
    #4452
    @ arcanis

• 0.34.4-rc.4 - 2025-09-17
  

  • Upgrade to libvips v8.17.2 for upstream bug fixes.

  • Ensure TIFF subifd and OpenSlide level input options are respected (regression in 0.34.3).

  • Ensure autoOrient occurs before non-90 angle rotation.
    #4425

  • Ensure autoOrient removes existing metadata after shrink-on-load.
    #4431

  • TypeScript: Ensure KernelEnum includes linear.
    #4441
    @ BayanBennett

  • Ensure unlimited flag is passed upstream when reading TIFF images.
    #4446

  • Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
    #4451

  • Add sharp-libvips rpath for yarn v5 support.
    #4452
    @ arcanis

• 0.34.4-rc.3 - 2025-09-15
  

  • Upgrade to libvips v8.17.2 for upstream bug fixes.

  • Ensure autoOrient occurs before non-90 angle rotation.
    #4425

  • Ensure autoOrient removes existing metadata after shrink-on-load.
    #4431

  • TypeScript: Ensure KernelEnum includes linear.
    #4441
    @ BayanBennett

  • Ensure unlimited flag is passed upstream when reading TIFF images.
    #4446

  • Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
    #4451

  • Add sharp-libvips rpath for yarn v5 support.
    #4452
    @ arcanis

• 0.34.3 - 2025-07-10
  No content.
• 0.34.3-rc.1 - 2025-07-09
  No content.
• 0.34.3-rc.0 - 2025-06-14
  No content.
• 0.34.2 - 2025-05-20
  No content.
• 0.34.2-rc.0 - 2025-05-14
• 0.34.1 - 2025-04-07
• 0.34.0 - 2025-04-04
• 0.34.0-rc.1 - 2025-04-03
• 0.34.0-rc.0 - 2025-03-16
• 0.33.5 - 2024-08-16
• 0.33.5-rc.1 - 2024-08-14
• 0.33.5-rc.0 - 2024-08-13
• 0.33.4 - 2024-05-16
• 0.33.4-rc.0 - 2024-05-16
• 0.33.3 - 2024-03-23
• 0.33.3-rc.0 - 2024-03-22
• 0.33.2 - 2024-01-12
• 0.33.2-rc.1 - 2024-01-12
• 0.33.2-rc.0 - 2024-01-11
• 0.33.1 - 2023-12-17
• 0.33.1-rc.3 - 2023-12-17
• 0.33.1-rc.2 - 2023-12-17
• 0.33.1-rc.0 - 2023-12-12
• 0.33.0 - 2023-11-29
• 0.33.0-rc.2 - 2023-11-22
• 0.33.0-alpha.11 - 2023-11-10
• 0.33.0-alpha.10 - 2023-11-04
• 0.33.0-alpha.9 - 2023-10-13
• 0.33.0-alpha.8 - 2023-10-10
• 0.33.0-alpha.7 - 2023-10-10
• 0.33.0-alpha.6 - 2023-10-09
• 0.33.0-alpha.4 - 2023-10-06
• 0.33.0-alpha.3 - 2023-10-06
• 0.32.6 - 2023-09-18
• 0.32.5 - 2023-08-15
• 0.32.4 - 2023-07-21
• 0.32.3 - 2023-07-14
• 0.32.2 - 2023-07-11
• 0.32.1 - 2023-04-27
• 0.32.0 - 2023-03-24

from sharp GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[Copilot]

Pull Request Overview

This PR updates the sharp image processing library from version 0.32.0 to 0.34.4, bringing significant architectural changes and modernization. The update transitions sharp from using prebuild-install to utilizing optional platform-specific dependencies and updates the minimum Node.js version requirement.

Key changes:

• Updates sharp package from 0.32.0 to 0.34.4
• Replaces the old build system (prebuild-install, color, node-addon-api) with new architecture using @img/colour and platform-specific optional dependencies
• Updates minimum Node.js version from >=14.15.0 to ^18.17.0 || ^20.3.0 || >=21.0.0

Reviewed Changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
website/package.json	Updates sharp dependency version from ^0.32.0 to ^0.34.4
website/package-lock.json	Updates sharp and its dependencies, adds new platform-specific optional dependencies (@img/sharp-*), removes old build-related dependencies (prebuild-install, color, node-addon-api)

Files not reviewed (1)

• website/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.